Wrong ranking in filter field (Graylog v.2.4.6)

For some reason the screenshot you posted before won’t load anymore but I recall that it wasn’t mixing randomly, it was string sorting rather than number sorting. But you state the data type for the field is long. Are you sure that these are storing as long? Did you apply a custom index mapping? Are you using an extractor that converts the data to a number?

Has it ever sorted correctly for you? If it used to sort correctly and now it’s not I would suspect that the index has rotated and the data is now being stored as a string.

Please provide more information.

1 Like